Upgrade Argo CD to chart 10.8.4 (v3.5.2)

Removes the cause of the diff failures that ServerSideDiff worked around:
v2.13.8 diffs against a Kubernetes schema compiled into its own binary,
and this cluster is newer than that schema.

Three things needed real changes, none of them mechanical:

- applicationSet.enabled no longer exists, and there is no replacement
  gate — unlike dex and notifications, the ApplicationSet controller's
  Deployment carries no conditional at all. Helm ignores unknown keys, so
  carrying the old value forward would have quietly started a controller
  nothing here uses. replicas: 0 is the only lever.

- The image tag pin is dropped rather than moved to v3.5.2. The chart's
  appVersion governs, so image and chart cannot drift; a pin outliving its
  chart is close to the failure being fixed here.

- server.insecure moved from server.extraArgs to configs.params, which is
  what the chart renders into argocd-cmd-params-cm. Caught by rendering:
  an earlier version of this commit deleted the extra arg on the strength
  of a comment claiming configs.params already set it, which it did not —
  Argo CD would have served its own TLS behind Contour and produced a
  redirect loop.

Verified in the rendered output: image v3.5.2 and no v2.13.8 anywhere,
server.insecure true, dex and notifications absent, ApplicationSet at zero
replicas, both HPAs intact with replicas omitted, ingress on Contour, repo
Secrets on cluster DNS.

Behaviour changes in v3 that apply here, none needing a values change:
logs RBAC is now enforced (jenkins-ci only syncs), update/delete no longer
inherit to sub-resources, and resource tracking moves from labels to
annotations, so the first sync re-stamps every managed resource.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

helm-overrides/gke-toolshed-prd-usc1/argocd-admin-prd/custom-values.yaml

@@ -4,9 +4,18 @@ argo-cd:
   # Installed once by hand with `helm install argocd-admin-prd` (namespace
   # "argocd"), then manages itself through the argocd Application in
   # devops-infra-argo-config-gcp, whose nameOverride matches that release.
-  global:
-    image:
-      tag: "v2.13.8"
+  # Deliberately no image tag pin, unlike the homelab: the chart's own
+  # appVersion (v3.5.2) governs, so the image cannot drift from the chart.
+  # A pin that outlives its chart is close to the failure this upgrade
+  # fixes — software older than the cluster it manages.
+  #
+  # Upgraded from chart 7.7.23 / Argo CD v2.13.8. Three v3 behaviour changes
+  # apply to this deployment, none of which needs a values change today:
+  #   - logs RBAC is now enforced, so an account that reads pod logs needs
+  #     an explicit `logs, get` policy. jenkins-ci below only syncs.
+  #   - update/delete no longer inherit to an application's sub-resources.
+  #   - resource tracking moves from labels to annotations, so the first
+  #     sync after the upgrade re-stamps every managed resource.
 
   # SSO still deferred, same as the homelab.
   dex:
@@ -65,8 +74,10 @@ argo-cd:
       maxReplicas: 3
       targetCPUUtilizationPercentage: 70
       targetMemoryUtilizationPercentage: null
-    extraArgs:
-      - --insecure
+    # --insecure is NOT set here as an extra arg: configs.params below
+    # carries server.insecure, which is the supported way to express it and
+    # is what the chart renders into argocd-cmd-params-cm. Setting both
+    # works but leaves two places to disagree.
     ingress:
       enabled: true
       ingressClassName: contour
@@ -79,12 +90,30 @@ argo-cd:
         cpu: 200m
         memory: 256Mi
 
+  # applicationSet.enabled no longer exists in this chart, and there is no
+  # replacement: unlike dex and notifications below, the ApplicationSet
+  # controller's Deployment has no conditional at all. replicas: 0 is the
+  # only lever — the Deployment exists but runs nothing. Carrying the old
+  # `enabled: false` forward would have quietly started the controller,
+  # since Helm ignores unknown keys.
+  #
+  # Nothing here uses the ApplicationSet CRD; Applications are rendered by
+  # generic-argo-apps-chart instead.
   applicationSet:
-    enabled: false
+    replicas: 0
   notifications:
     enabled: false
 
   configs:
+    # Contour terminates TLS in front of Argo CD; leaving Argo CD's own TLS
+    # on as well produces a redirect loop. This renders into
+    # argocd-cmd-params-cm, which the server actually reads.
+    #
+    # This file previously expressed it as server.extraArgs: [--insecure],
+    # inherited from the homelab. Both work, but only one should exist, and
+    # the rendered ConfigMap is the thing to check when it looks wrong.
+    params:
+      server.insecure: true
     cm:
       url: "http://argocd.35.238.248.203.nip.io"
       timeout.reconciliation: 3m